Pop-ups that will not go away. A browser that keeps landing on a search page you never chose. A PC that was fine last week and now crawls. When someone hands me a machine like that, the first thing I reach for is Malwarebytes. It has been my go-to for malware, system cleanups and “just check it for anything nasty” jobs for years.
There are plenty of tools for fighting malware, free and paid. This article explains why Malwarebytes is the one I start with, what it does not do, how to run a cleanup properly, and which alternatives are worth keeping in your kit. Nobody paid for this article and there are no affiliate links in it.
Work computer? Stop here and call your IT or security team. Do not try to clean it yourself. They need to know what happened, and they may need the machine exactly as it is.
What Malwarebytes is
Malwarebytes is a security program for Windows, Mac, Android and iOS that built its name on removing the things traditional antivirus used to miss: adware, browser hijackers, fake “PC optimizers”, toolbars and other potentially unwanted programs (PUPs), along with trojans, spyware and ransomware. It comes in two versions.
| Free | Premium (paid subscription) | |
|---|---|---|
| Scan and remove on demand | Yes | Yes |
| Real-time protection (blocks threats before they run) | No | Yes |
| Ransomware and exploit protection | No | Yes |
| Blocks malicious and scam websites | No (the separate Browser Guard extension is free) | Yes |
| Scheduled scans | No, you run them by hand | Yes |
| Allowed for | Personal, non-business use | Personal use. Businesses use the company’s ThreatDown products. |
In plain terms: the free version is a cleanup tool. It finds and removes what is already on the machine, and then it sits there until you run it again. The paid version is a guard. It stays awake and tries to stop the infection from happening in the first place.
One thing catches people out. A new install usually starts a 14-day trial of Premium. When the trial ends it drops back to the free version on its own. You are not charged, and you do not have to buy anything to keep scanning.
Why it is my go-to
- It is fast to put to work. Small download, quick install, and you are scanning within a few minutes. No account is needed for the free version.
- The free scan really removes things. Some “free scanners” find problems and then ask for a credit card to fix them. Malwarebytes Free quarantines what it finds.
- It is good at the junk. Adware, hijacked browsers and PUPs are what most home users actually have, and this is where Malwarebytes has always been strong.
- It plays well with others. The free version runs happily alongside Microsoft Defender or another antivirus, which makes it an ideal second opinion.
- Quarantine, not delete. Everything it removes goes to quarantine first, so a false alarm can be restored.
- Regular people can use it. One big Scan button and a clear result. It is simple enough to talk someone through over the phone.
Where it falls short
- The free version does not protect you. It only cleans up afterwards. If Malwarebytes Free is all you rely on, you have no real-time protection from it at all. Keep Microsoft Defender or another antivirus switched on.
- Expect upgrade prompts. The free version reminds you about Premium. It is not aggressive, but it is there.
- Premium is a subscription, billed yearly per device, and the price goes up with the number of devices. Check the renewal price, not just the first-year offer.
- Independent lab results are thinner than for the big names. Malwarebytes has not always taken part in, or topped, the well-known antivirus lab tests such as AV-TEST and AV-Comparatives. Its reputation comes mostly from cleanup work in the field.
- False positives happen. It can flag legitimate admin tools, key finders, game trainers and some remote support software as PUPs. Read the list before you remove everything.
- It cannot undo damage. It will not decrypt files after ransomware, recover stolen passwords, or fix Windows files that malware has broken.
- No tool catches everything. That includes this one. A clean scan is good news, not proof.
How to run a proper cleanup
- Think before you start. If files have been renamed or encrypted, or a ransom note is on the screen, unplug the network cable or turn off Wi-Fi now, and skip to “When cleaning is not enough” below.
- Stop using the PC for anything sensitive. No banking, no email, no password manager until it is clean.
- Download Malwarebytes from malwarebytes.com only. Fake copies exist. If the infected PC blocks the site or the installer, download it on a clean computer and carry it over on a USB stick.
- Install it, let it update, and run a Scan. The default Threat Scan checks memory, startup items, the registry and the places malware normally lives. That is the right scan for nearly every case.
- Review what it found, then quarantine. Untick anything you know is legitimate. Quarantine the rest and restart when it asks. Some items can only be removed during a restart. And yes, Restart, not Shut down.
- Scan again after the restart. You want a clean result before you move on.
- Get a second opinion. Run one of the on-demand scanners from the alternatives below. Different tools catch different things.
- Check what scanners miss. Look through browser extensions and remove any you do not recognise, reset the browser home page and search engine, review Settings > Apps > Installed apps sorted by install date, and check Task Manager > Startup apps.
- Patch everything. Run Windows Update until it finds nothing, and update your browsers. Most infections get in through something that was out of date.
- Change your passwords from a different, clean device. Start with email and banking, turn on multi-factor authentication, and use each account’s “sign out of all devices” option. Modern password-stealing malware copies your browser’s saved logins and login sessions, so assume it got them.
Malware fighting back? If it keeps closing the installer or blocking the scan, restart in Safe Mode with Networking (hold Shift while you click Restart, then Troubleshoot > Advanced options > Startup Settings) and run the scan from there.
When cleaning is not enough
Some infections should not be cleaned. They should be wiped. Back up your documents and photos, reset or reinstall Windows, and restore only the data, when:
- Ransomware ran on the machine.
- A remote access trojan was found, or a “support technician” scammer was given remote control.
- The scan found a rootkit or a password stealer, or the same infection keeps coming back.
- The PC is used for banking, business or anything else you cannot afford to be wrong about.
A cleanup tells you what the tool found. It cannot tell you what it missed. A clean reinstall is the only way to be certain, and on a modern PC Settings > System > Recovery > Reset this PC makes it a one-hour job.
Alternatives worth knowing
For protection, all day, every day
- Microsoft Defender Antivirus. Built into Windows 10 and 11, free, real-time, and these days it scores well in independent tests. For most home users, Defender plus sensible habits is enough, with Malwarebytes Free as the second opinion. It also includes Microsoft Defender Offline, a scan that runs before Windows starts, which is the right tool for stubborn infections and rootkits.
- A paid security suite such as Bitdefender or ESET, if you want extras like a firewall, parental controls or one licence for the whole family. Only run one real-time antivirus at a time.
For a second opinion, on demand
| Tool | Cost | Good for |
|---|---|---|
| Microsoft Safety Scanner | Free | A portable scanner from Microsoft, no install needed. Each download expires after 10 days, so always get a fresh copy. |
| ESET Online Scanner | Free | A thorough one-time scan from a respected antivirus engine. Slower, but it finds things. |
| Emsisoft Emergency Kit | Free for home use | Runs from a USB stick without installing. Made for techs cleaning other people’s machines. |
| HitmanPro (Sophos) | 30-day free trial, then paid | A very fast cloud-based second-opinion scan. |
| Norton Power Eraser | Free | Aggressive removal of deeply embedded threats. More false positives, so use it as a last step before a rebuild. |
| AdwCleaner (from Malwarebytes) | Free | Adware, toolbars and browser hijackers only. Tiny, fast, no install. |
For a business
The free tools above are licensed for personal use. A business needs centrally managed protection with reporting and alerting, so that someone knows when a machine is infected. Look at Microsoft Defender for Business or Defender for Endpoint, Malwarebytes’ business line ThreatDown, or one of the other managed endpoint products. Cleaning machines one at a time with a free scanner is not a security plan.
The bottom line
- Think you have malware right now? Get Malwarebytes Free, scan, quarantine, restart, scan again. Then get a second opinion and change your passwords from another device.
- Want to stay protected? Keep Microsoft Defender on and Windows up to date, and keep Malwarebytes Free around for checkups. Pay for Premium if you want its real-time and web protection, or if the person using the PC clicks on everything.
- Hit by something serious? Wipe it and start clean.
The best malware tool is still the one between the chair and the keyboard: keep things updated, do not install what you did not go looking for, and be suspicious of anything that is in a hurry.
Your turn: what is in your toolkit?
Every tech has a favorite tool, and strong opinions about everyone else’s. Got a cleanup tool you swear by, or one you swear at? Post it in the General forum and defend your choice. Bragging rights are free, and unlike a Premium trial, they never expire. If it is good enough, it may end up in this article. Still fighting an infection that will not die? Bring the gory details to the Help forum, where the best answer earns points on the leaderboard.